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Project Request awGae d i 
Project #19090 : DoGaP, Data Access Request, “Trajectories of Complex Phenotypes (#67931-1),” inertial arr 
July 15, 2018 


Approved Research Use Statement 
Note: I’ve already received access to these data (#18007), but for different research questions. 


Non-technical summary 
In the USA, diagnosis rates for different mental disorders (e.g., schizophrenia, depression) vary across ethnic groups. Moreover, the rate differences 


have often been attributed to diagnostic bias (e.g., Escobar, 2012). Recent genomic research, however, implicates evolutionary causes for these 
effects in some cases. For example, analyzing polygenic scores both globally and in the USA, Guo et al. (2018) found evidence of natural selection 
for schizophrenia in context with European, African, and East Asian descent groups. As polygenic scores have questionable cross-ethnic validity, 
substantial uncertainty about such results exists. Therefore, | will utilize “Trajectories of Complex Phenotypes” to investigate the evolutionary 
hypothesis via admixture analyses. Specifically, | will employ admixture analysis to determine if global ancestry predicts mental health outcomes. | 
will also apply admixture mapping (Shriner, 2013) to determine which regions of the genome are most strongly associated with the outcomes. 


RUS 

Title: Using Admixture Analysis to Predict Psychological Disorders in an Admixed American Sample 
Funding body: None 

Keywords provided by the Applicant PI to describe the research project: 

Ethnicity, Ancestry, Schizophrenia, Psychiatry, Mood / cognitive disorders 


“Using Admixture Analysis to Predict Psychological 


Disorders in an Admixed American Sample” 
In the USA, diagnosis rates for different mental disorders (e.g., schizophrenia, depression) vary across ethnic groups. Moreover, the rate differences 


have often been attributed to diagnostic bias (e.g., Escobar, 2012). Recent genomic research, however, implicates evolutionary causes for these 
effects in some cases. For example, analyzing polygenic scores both globally and in the USA, Guo et al. (2018) found evidence of natural selection 
for schizophrenia in context with European, African, and East Asian descent groups. As polygenic scores have questionable cross-ethnic validity, 
substantial uncertainty about such results exists. Therefore, | will utilize “Trajectories of Complex Phenotypes” to investigate the evolutionary 
hypothesis via admixture analyses. Specifically, | will employ admixture analysis to determine if global ancestry predicts mental health outcomes. | 
will also apply admixture mapping (Shriner, 2013) to determine which regions of the genome are most strongly associated with the outcomes. 
Finally, to maximize statistical power, | will use the full sample. Genotypic data will be used to ascertain ancestry. 

| will leverage genotypic data to compute ancestry percentages and to identify regions of the genome where associations are prominent. The study 
will primarily involve regression analyses, looking at the association between ancestry and outcomes. | will also use SNP genotypes to create 


ancestry estimates, along with demographic data (e.g., age, sex, etc.) and neuropsychiatric data. 


References: 

Escobar, J. |. (2012). Diagnostic bias: Racial and cultural issues. Psychiatric Services, 63(9), 847-847. 

Guo, J., Wu, Y., Zhu, Z., Zheng, Z., Trzaskowski, M., Zeng, J., & Yang, J. (2018). Global genetic differentiation of complex traits shaped by natural 
selection in humans. Nature communications, 9(1), 1865. 

Shriner, D. (2013). Overview of admixture mapping. Current protocols in human genetics, 76(1), 1-23. 


Non-Technical Summary 


In the USA, diagnosis rates for different mental disorders (e.g., schizophrenia, depression) vary across ethnic groups. Moreover, the rate differences 
have often been attributed to diagnostic bias (e.g., Escobar, 2012). Recent genomic research, however, implicates evolutionary causes for these 
effects in some cases. For example, analyzing polygenic scores both globally and in the USA, Guo et al. (2018) found evidence of natural selection 
for schizophrenia in context with European, African, and East Asian descent groups. As polygenic scores have questionable cross-ethnic validity, 
substantial uncertainty about such results exists. Therefore, | will utilize “Trajectories of Complex Phenotypes” to investigate the evolutionary 
hypothesis via admixture analyses. Specifically, | will employ admixture analysis to determine if global ancestry predicts mental health outcomes. | 
will also apply admixture mapping (Shriner, 2013) to determine which regions of the genome are most strongly associated with the outcomes. 
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Use Limitation : 


Neurodevelopmental Genomics: Trajectories of Complex Phenotypes 


70647 

1 

General Research Use (NPU) 
GRU-NPU 


Use of the data is limited only by the terms of the model Data Use Certification. Use of the data is limited to not-for-profit 
organizations. Restricted to research on genotype-phenotype associations; and molecular phenotype (e.g., gene 
expression; microRNA)-phenotype associations. Non-profit use only. 
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Model Data Use Certification Agreement 
Neurodevelopmental Genomics: Trajectories of Complex Phenotypes 


(October 12, 2012, version) 


Introduction and Statement of Policy 


The National Institutes of Health (NIH) has developed central data repositories to archive and 
distribute the results of studies provided by Contributing Investigators examining the relationship 
between genomic data (e.g., genotype, sequence, or epigenetic information) and phenotype. Such 
studies include genome-wide association studies, medical sequencing, and molecular diagnostic 
assays. Implicit in the establishment of the NIH data repositories, for example the database of 
Genotypes and Phenotypes (dbGaP), is the view that scientific progress in this area will be greatly 
enhanced if the data produced by these studies are readily available to all investigators in the 
research community. 


Dataset access will be provided to research investigators who, along with their institutions, have 
certified their agreement with the expectations and terms of access detailed below. It is the intent 
of the NIH and NIMH that Approved Users of NIH-provided datasets recognize any restrictions on 
data use delineated within the original informed consent agreements of contributing studies, as 
identified by the submitting institutions and stated on database websites. 


Definitions of terminology used in this document are found in the Appendix. 


The parties to this agreement include: the Principal Investigator (PI) requesting access to the 
genomic study dataset (“the Approved User”), his/her home institution as represented by the 
Institutional Signing Official designated through the eRA Commons system (“the Requester”), and 
the NIMH, NIH. The effective date of this agreement shall be the Project Approval Date, as 
specified on the Data Access Committee approval notification. 


Terms of Access 


1. Research Use 


The Requester agrees that if access is approved, the Principal Investigator named in the Data 
Access Request (DAR) submitted to the NIH, those named in the “Senior/Key Person Profile” 
portion of the DAR, which should include the Information Technology Director or his/her designee, 
and any trainee or employee working on the proposed research project under the direct 
supervision of these individuals, shall become Approved Users of the requested dataset(s). 
Research use will occur solely in connection with the research project described in the DAR, which 
includes a 1-2 paragraph description of the research objectives and design. New uses of these 
data outside those described in the DAR will require submission of a new DAR; modifications to 
the research project will require submission of an amendment to this application (e.g., the 
addition of new aims related to the approved project, adding or deleting collaborators from the 
same institution, and thepotential addition of new NIH genomic datasets to an approved project). 
The Requester and all Approved Users may use the dataset(s) only in accordance with the 
parameters described on the NIH database Web site for the appropriate research use, and any 
limitations on such use, of the dataset(s) and as required by law. 


Research access to the requested dataset(s) is granted for a period of one (1) year as defined 
below. 
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Contributing Investigators, or their direct collaborators, who provided the data or samples used to 
generate an NIH genomic dataset and who have appropriate IRB approval, if applicable, for 
broader use of the data are exempt from the limitation on the scope of the research use as 
defined in the DAR. 


NIMH Specific Terms: 
2. Institutional and Approved User Responsibilities 


The Requester agrees through the submission of the Data Access Request (DAR) that the PI 
named in the DAR has reviewed and understands the principles for responsible research use and 
data handling of the genomic datasets as defined in the NIH GWAS Data Sharing Policy and as 
detailed in this Data Use Certification (DUC) agreement and in the dbGaP Approved User Code of 
Conduct. The Requester and Approved Users further acknowledge that they are responsible for 
ensuring that all uses of the data are consistent with federal, state, and local laws and regulations 
and any relevant institutional policies. The Requester certifies that the Approved User is in good 
standing with the institution and relevant funding agencies (i.e., no Known sanctions) and is 
eligible to conduct independent research. Through submission of the DAR, the Principal 
Investigator also agrees to submit annual data use reports to the appropriate NIH Data Access 
Committee (DAC) describing the research use of the Approved Users as described under 
“Research Use Reporting” below. 


Approved Users who may have access to personal identifying information for research participants 
in the original study at their institution or through their collaborators, may be required to have 
IRB approval. By approving and submitting the attached Data Access Request, the Institutional 
Signing Official provides assurance that relevant institutional policies and applicable federal, state, 
or local laws and regulations (if any) have been followed, including IRB approval if required. The 
Institutional Signing Official also assures through the approval of the Data Access Request that 
other organizations within the institution with relevant authorities (e.g., the Office of Human 
Subjects Research, the Office of Information Technology, the Office of Technology Transfer, etc.) 
have reviewed the relevant sections of the NIH GWAS Data Sharing Policy and the associated 
procedures and are in agreement with the principles defined. 


It is anticipated that, at least in some cases, these datasets will be updated with additional 
information. Unless otherwise indicated, all statements herein are presumed to be true and 
applicable to the access and use of all versions of these datasets. 


3. Public Posting of Approved User’s Research Use Statement 


The Principal Investigator agrees that, if he or she becomes an Approved User, information about 
the PI and the approved research use may be posted on a public, US government web site that 
describes approved research projects. The information may include the Approved User’s name and 
institution, project name, Research Use Statement, and a Non-technical Summary of the Research 
Use Statement. In addition, citations resulting from the use of NIH genomic datasets may be 
posted on NIH data repository websites. 


4. Non-Identification 


Approved Users agree not to use the requested datasets, either alone or in concert with any other 
information, to identify or contact individual participants from whom phenotype data and DNA 
samples were collected. This provision does not apply to research investigators operating with 
specific IRB approval, pursuant to 45 C.F.R. 46, to contact individuals within datasets or to obtain 
and use identifying information under an approved IRB research protocol. All investigators 
conducting “human subjects research” within the scope of 45 C.F.R. 46 must comply with the 
requirements contained therein. 
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5. Non-Transferability 


The Requester and Approved Users agree to retain control over the data and further agree not to 
distribute data obtained through this Data Access Request to any entity or individual not covered 
in the submitted Data Access Request. If Approved Users are provided access to NIH genomic 
datasets for inter-institutional collaborative research described in the Research Use Statement of 
the Data Access Request, and all members of the collaboration are also Approved Users through 
their home institution(s), data obtained through this Data Access Request may be securely 
transmitted within the collaborative group. All data security practices and other terms of use 
defined in this agreement and the dbGaP Security Best Practices for the raw data are expected to 
be followed for the derived data, including any transmission of the data. 


The Requester and Approved Users acknowledge responsibility for ensuring the review and 
agreement to the terms within this Data Use Certification and the appropriate research use of NIH 
genomic data by research staff associated with any approved project, subject to applicable laws 
and regulations. NIH genomic datasets obtained through this Data Access Request, in whole or in 
part, may not be sold to any individual at any point in time for any purpose. 


Approved Users agree that if they change institutions during the access period, they will submit a 
new Data Access Request and Data Use Certification in which the new institution agrees to the 
NIH GWAS data use policy before data access resumes. Any versions of data stored at the prior 
institution for the approved use will be destroyed and documented through a final Data Use Report 
as described below. However, if advance written notice and approval by the NIMH Data Access 
Committee is obtained to transfer responsibility for the approved research project to another 
Approved User within the same institution the data may not need to be destroyed. 


6. Data Security and Data Release Reporting 


The Requester and Approved Users, including the institutional Information Technology Director or 
his/her designee, acknowledge the intent of the NIH that they have reviewed and agree to handle 
the requested dataset(s) according to the current dbGaP Security Best Practices , including its 
detailed description of requirements for security and encryption. These include, but are not limited 
to: 


o all Approved Users have completed all required computer security training required by their 
institution, for example, the http://irtsectraining.nih.gov/ , or the equivalent; 

o the data will always be physically secured (for example, through camera surveillance, locks 
on doors/computers, security guard); 

o servers must not be accessible directly from the internet, (for example, they must be 
behind a firewall or not connected to a larger network) and unnecessary services should be 
disabled; 

o use of portable media, e.g., on a CD, flash drive or laptop, is discouraged, but if necessary 
then they should be encrypted consistent with applicable law; 

o use of updated anti-virus/anti-spyware software; 

o security auditing/intrusion detection software, detection and regular scans of potential data 
intrusions; 

o use of strong password policies for file access. 

o all copies of the dataset should be destroyed, as permitted by law and local institutional 
policies, whenever any of the following occurs: 

e the DUC expires and renewal is not sought; 

e access renewal is not granted; 

e the NIMH requests destruction of the dataset; 

e the continued use of the data would no longer be consistent with the DUC. 


In addition, the Requester and Approved Users agree to keep the data secure and confidential at 
all times and to adhere to information technology practices in all aspects of data management to 
assure that only authorized individuals can gain access to NIH genomic datasets. This agreement 
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includes the maintenance of appropriate controls over any copies or derivatives of the data 
obtained through this Data Access Request. 


Requesters and Approved Users agree to notify the NIMH Data Access Committee of any 
unauthorized data sharing, breaches of data security, or inadvertent data releases that may 
compromise data confidentiality within 24 hours of when the incident is identified. As permitted by 
law, notifications should include the known information regarding the incident and a general 
description of the activities or process in place to fully define and remediate the situation. Within 3 
business days of the NIMH Data Access Committee notification, the Requester, through the 
Approved User and the Institutional Signing Official, agree to submit to the NIMH Data Access 
Committee a more detailed written report including the date and nature of the event, actions 
taken or to be taken to remediate the issue(s), and plans or processes developed to prevent 
further problems, including specific information on timelines anticipated for action. 


All notifications and written reports of data security incidents should be sent to: 


NIMH, Data Access Committee ( URGENTJIAAMHDAC@mail.nih.gov ) 


The NIMH, the NIH, or another entity designated by the NIH may, as permitted by law, also 
investigate any data security incident. Approved Users and their associates agree to support such 
investigations and provide information, within the limits of applicable local, state and federal laws 
and regulations. In addition, Requesters and Approved Users agree to work with the NIMH and the 
NIH to assure that plans and procedures developed to address identified problems are mutually 
acceptable consistent with applicable law. 


7. Intellectual Property 


By requesting access to genomic dataset(s), the Requester and Approved Users acknowledge the 
intent of the NIH that anyone authorized for research access through the attached Data Access 
Request follow the intellectual property principles within the NIH GWAS Policy for Data Sharing as 


summarized below: 


e Achieving maximum public benefit is the ultimate goal of data distribution through the NIH 
genomic data repositories. The NIH believes that these data should be considered as pre- 
competitive, and urges Approved Users to avoid making IP claims derived directly from the 
genomic dataset(s). However, the NIH also recognizes the importance of the subsequent 
development of IP on downstream discoveries, especially in therapeutics, which will be 
necessary to support full investment in products to benefit the public. 

e It is expected that these NIH-provided data, and conclusions derived therefrom, will remain 
freely available, without requirement for licensing. The NIH encourages broad use of 
genomic datasets coupled with a responsible approach to management of intellectual 
property derived from downstream discoveries in a manner consistent with the NIH’s Best 
Practices for the Licensing of Genomic Inventions and the NIH Research Tools Policy . 


8. Research Dissemination and Acknowledgement of NIH Genomic Study 


It is the intent of the NIH to promote the dissemination of research findings from NIH genomic 
dataset(s) as widely as possible through scientific publication or other appropriate public 
dissemination mechanisms. Approved Users are strongly encouraged to publish their results in 
peer-reviewed journals and to present research findings at scientific meetings, etc. 


In accord with the NIH GWAS Policy for Data Sharing , and as expressed through the submission 
of the DAR, Approved Users acknowledge the NIH’s expectation that they will not submit 
findings using the " Neurodevelopmental Genomics: Trajectories of Complex 
Phenotypes " dataset(s), or updated versions thereof, for publication or presentation 
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for a period of exclusivity for Contributing Investigators concluding with the Embargo 
Date identified on the dbGaP or other NIH genomic data repository homepage. 


Approved Users agree to acknowledge the NIH data repository, the Contributing Investigator(s) 
who contributed the phenotype data and DNA samples from his/her original study, and the 
primary funding organization that supported the contributing study in all oral and written 
presentations, disclosures, and publications resulting from any analyses of the data. Approved 
Users further agree that the acknowledgment shall include the dbGaP accession number to the 
specific version of the dataset(s) analyzed. 


A sample statement for the acknowledgment of the " Neurodevelopmental Genomics: 
Trajectories of Complex Phenotypes " dataset(s) follows: 


Drs. Gur, Hakonarson, and collaborators request that publications resulting from these data cite 
their original publication: [TBD]. Support for the collection of the data sets was provided by grant 
RC2MH089983 awarded to Raquel Gur and RC2MH089924 awarded to Hakon Hakonarson. All 
subjects were recruited through the Center for Applied Genomics at The Children’s Hospital in 
Philadelphia. 


9. Research Use Reporting 


To assure that NIH policies and procedures for genomic data use are adhered to, Approved Users 
agree to provide to the NIMH Data Access Committee annual feedback on how these data have 
been used and any results that have been generated as a result of access to the data, including 
patents and publications. This information will be used by the NIMH Data Access Committee staff 
for program evaluation activities, and may be considered by the NIH GWAS Governance 
committees as part of the NIH effort to provide ongoing oversight and management of all NIH 
genomic data sharing activities. 


Approved Users thus agree to provide a brief Annual Data Use Report on the research specified 
within the DAR submitted with this DUC. Approved Users who are seeking renewal agree to 
provide specific information in a renewal DAR. Those not seeking renewal agree to provide specific 
information to the Data Access Committee via the contact information below. Annual Data Use 
Reports will provide information regarding potentially significant findings and publications or 
presentations that resulted from the use of the requested dataset(s), a summary of any plans for 
future research use, any violations of the terms of access described within this Data Use 
Certification and the implemented remediation, and information on any downstream intellectual 
property generated as a result of the data. Approved Users also may include general comments 
regarding topics such as the effectiveness of the NIH genomic data access process (e.g., ease of 
access and use), appropriateness of data format, challenges in following the policies, and 
suggestions for improving data access or the program in general if desired. 


Approved Users agree to send the Annual Data Use Report prior to the anniversary of the 
Approved Access Date assigned by the DAC and specified within the manifest file provided to 
Approved Users by the NIH Data Repository at the time that data access is provided. It is agreed 
that the Annual Data Use Report will be shared with the NIH within the context of a renewal Data 
Access Request, or via a letter signed by the Institutional Signing Official and the Approved User. 


Annual Data Use Reports should be submitted to: JAAMHDAC@mail.nih.gov 


unless otherwise indicated in automated reminder messages from NCBI/dbGaP. Requests for 
continued data access should be made through dbGaP. 


Note that any inadvertent or inappropriate data release incidents should be reported to 
the NIMH Data Access Committee according to the agreements and instructions under 


Term 6. 
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10. Non-Endorsement, Indemnification 


The Requester and Approved Users acknowledge that although all reasonable efforts have been 
taken to ensure the accuracy and reliability of NIH genomic data, the NIH, the NIMH Data Access 
Committee, and Contributing Investigators do not and cannot warrant the results that may be 
obtained by using any data included therein. The NIH, the NIMH Data Access Committee, and all 
contributors to these datasets disclaim all warranties as to performance or fitness of the data for 
any particular purpose. 


No indemnification for any loss, claim, damage or liability is intended or provided by any party 
under this agreement. Each party shall be liable for any loss, claim, damage, or liability that said 
party incurs as a result of its activities under this agreement, except that the NIH, as an agency of 
the United States, may be liable only to the extent provided under the Federal Tort Claims Act, 28 
U.S.C. 2671 et seq. 


11. Termination and Violations 


This Data Use Certification will be in effect for a period of one (1) year from the date the 
dataset(s) are made accessible to the Approved User (“Approved Access Date”). At the end of the 
access period, Approved Users agree to destroy all copies of the requested dataset(s), except as 
required by publication practices or law to retain them. 


Consideration will be given to a renewal of this agreement upon submission of a new DAR. Copies 
of NIH genomic dataset(s) may not need to be destroyed if, with advance notice and approval by 
the NIMH Data Access Committee, the project has been transferred to another Approved User. In 
this case, documentation must be provided that other Approved Users are using the dataset(s) 
under an active DAC approved research project at the same institution. 


The Requester and Approved User acknowledge that the NIH or the NIMH may terminate this 
agreement and immediately revoke access to all NIH genomic datasets at any time if the 
Requester is found to be no longer in agreement with the policies, principles and procedures of the 
NIH and the NIMH. 


2K KK AK OK KK KK OK OK OK OK OK OK 2K OK OK 2K OK OK 2K OK OK OK OK OK KK OK OK OK OK OK KOK OK OK OK KK 


By submission of the attached Data Access Request, the Requester through the Institutional 
Signing Official attests to the Approved Users’ qualifications for access to and use of NIH genomic 
dataset(s) and certifies their agreement to the NIH principles, policies and procedures for the use 
of the requested datasets as articulated in this document and as summarized in the dbGaP 
Approved User Code of Conduct, including the potential termination of access should a violation of 
any of these agreement terms be identified. 


Requesters and the Principal Investigator further acknowledge that they have shared this 
document, the dbGaP Approved User Code of Conduct, and the NIH GWAS data sharing policies 
and procedures for access and use of genomic datasets with any Approved Users, appropriate 
research staff, and all other Key Personnel identified in the DAR. 


Institutional Signing Officials acknowledge that they have considered the relevant NIH GWAS 
policies and procedures, that they have shared this document and the relevant policies and 
procedures with appropriate institutional organizations, and have assured compliance with local 
institutional policies related to technology transfer, information technology, privacy, and human 
subjects research. 
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Appendix 


Definitions of Terminology 


Annual Data Use Report: A report submitted to the DAC on the anniversary of access approval 
summarizing the analysis of NIH genomic datasets obtained through the Data Access Request and 
any significant findings derived from the work. 


Approved User: Post-DAC approval will include the PI, collaborators at the home institution who 
are named in the “Senior/Key Person Profile” portion of the DAR, the IT Director or designee 
named in the “Senior/Key Person Profile” portion of the DAR, and trainees or staff to these 
investigators. 


Contributing Investigator: The researcher who submitted the genomic dataset to dbGaP. 
Data Access Request: SF 424 (R&R) cover pages and requested attachments, if any. 


dbGaP Approved User Code of Conduct: any data including individual-level data or aggregate 
genomic data that stems from the original dataset obtained through dbGaP. Excepted from this 
term is summary information that is expected to be shared through community publication 


practices. 


Final Data Use Report: A final report submitted to the DAC at the conclusion of the approved 
access period when no additional access is sought, or when leaving an institution. This report 
should summarize the analysis of genomic study datasets obtained through the Data Access 
Request and any significant findings derived from the work. 


Information Technology Director: Someone with the authority to vouch for the IT capacities at 
an institution, or higher-level division of an institution (e.g., the School of Medicine). 


Institutional Signing Official: Someone with the authority to sign on behalf of the Requester 
and credentialed through the eRA system as such. 


Requester: The home institution/organization for the Primary Investigator (PI) that will use the 
requested data. 


Senior/Key Persons: Collaborators at the home institution, and the IT Director or designee. 
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Addendum to the Data Use Certification Agreement 
Modification of Data Security Terms and Best Practices 


Effective for all dbGaP Data Access Requesis submitted on or after March 23, 2015, 
Section 6 of the Data Use Certification Agreement is replaced in its entirety by the following: 


6. Data Security and Data Release Reporting 


The Requester and Approved Users, including the institutional IT Director, acknowledge NIH’s expectation 
that they have reviewed and agree to manage the requested dataset(s) according to the current NIH 
Security Best Practices for Controlled-Access Data Subject to the GDS Policy and the institutional IT 
security requirements and policies, and that the institution’s IT security requirements and policies are 
sufficient to protect the confidentiality and integrity of the NIH controlled-access data entrusted to the 


Requester. 


If approved by NIH to use cloud computing for the proposed research project, as outlined in the Research 
and Cloud Computing Use Statements of the Data Access Request, the Requester acknowledges that the 
IT Director has reviewed and understands the cloud computing guidelines in the NIH Security Best 
Practices for Controlled-Access Data Subject to the GDS Policy. 


Requesters and Pls agree to notify the JAAMH DAC of any unauthorized data sharing, breaches of data 
security, or inadvertent data releases that may compromise data confidentiality within 24 hours of when the 
incident is identified. As permitted by law, notifications should include any known information regarding the 
incident and a general description of the activities or process in place to define and remediate the situation 
fully. Within 3 business days of the JAAMH DAC notification, the Requester, through the PI and the 
Institutional Signing Official, agree to submit to the JAAMH Data Access Committee a detailed written 
report including the date and nature of the event, actions taken or to be taken to remediate the issue(s), 
and plans or processes developed to prevent further problems, including specific information on timelines 


anticipated for action. 


All notifications and written reports of data security incidents should be sent to: 
JAAMH Data Access Committee URGENT: URGENTJAAMHDAC@mail.nih.gov 
GDS mailbox: gds@mail.nih.gov 


NIH, or another entity designated by NIH may, as permitted by law, also investigate any data security 
incident. Approved Users and their associates agree to support such investigations and provide 
information, within the limits of applicable local, state, and federal laws and regulations. In addition, 
Requesters and Approved Users agree to work with the JAAMH and NIH to assure that plans and 
procedures that are developed to address identified problems are mutually acceptable and consistent with 


applicable law. 


